High severity · published Aug 15, 2017
CVE-2017-12852
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation
7.5
CVSS
2.7%
EPSS
No
On KEV
Description
The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NU
Numpy · Numpy
through 1.13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12852
github.com
https://github.com/BT123/testcasesForMyRequest/tree/master/CVE-2017-12852
Exploit
https://github.com/numpy/numpy/issues/9560#issuecomment-322395292
More from Numpy
9.8
CVE-2019-6446
An issue was discovered in NumPy before 1.16.3
5.5
CVE-2021-41496
Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an…
5.5
CVE-2014-1858
__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file
5.5
CVE-2014-1859
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary…
5.3
CVE-2021-41495
Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers…